Florian Grunow

The CycloneDX BOM Repository Server has an improper input validation issue leading to path traversal. This could allow a malicious user to create arbitrary directories or cause a denial of service by deleting arbitrary directories. The issue is not exploitable if the post and delete methods are disabled, which is the default configuration. This can be achieved by modifying the `appsettings.json` file or by setting the environment variables `ALLOWEDMETHODS POST` and `ALLOWEDMETHODS DELETE` to `false`.

A directory traversal flaw allows an authenticated attacker to exfiltrate or potentially delete files from the hosting server. This issue is related to the use of ../ in the `att local name` field in Deliver.class.php.

The issue is related to insufficient authentication of network packets when the cipherList configuration parameter is set. This can be exploited by a remote attacker to execute applications with administrator privileges.

The issue allows attackers to cause a denial of service, resulting in a daemon crash, by providing crafted arguments to a setuid program.